C1000-163

What must a deployment professional select when defining a new flow source?A . The destination portB . The source IP addressC . The flow source typeD . The router brandView AnswerAnswer: C

A deployment professional needs to migrate test rules developed in a test QRadar deployment to a production QRadar deployment. Which approach can be used to migrate the rules?A . Use the Use Case Manager to sync rules between the two deployments.B . Use the Content Management Tool (CMT) to migrate...

What happens to events and flows when data bursts exceed the license?A . All data beyond the license is lost.B . QRadar allows a 35-day grace period to update the license.C . The backlog is processed from a temporary queue when the license allowsD . QRadar automatically enables the License...

Which regex statement extracts the DNS host from the cs-host value from the payload?A . cs-host=www.?([^|]*)B . cs-host=.?www.(.*.?)C . cs-host=(?:www.)?([^|]*)|(?:add|get|query|delete)s+(?:www.)?([^s]+)D . cs-host=(?:www.)?([^|]*)|(?:http|ftp|tcp|https)s+(?:www.)?([^s]+)View AnswerAnswer: D

For a Source IP based offense, which field helps determine relative importance of the targets to the business?A . Relative importance of Destination IP(s)B . Duration of the offenseC . Total number of EventsD . Last Event/FlowView AnswerAnswer: A

Which component processes unallocated syslog messages, identifies the DSMs that are installed on the system, and then assigns the appropriate log source type to a new log source?A . Discovery analysisB . Autodetect trafficC . Traffic analysisD . DSM discovery analysisView AnswerAnswer: C

From which tabs can a QRadar custom rule be created?A . Offenses or Log Activity tabsB . Offenses, Log Activity or Network Activity tabsC . Log Activity or Network Activity tabsD . Offenses or Admin tabsView AnswerAnswer: B

In a multitenant environment, what is prevented by assigning log sources to a specific domain?A . Data integrityB . User creation for each domainC . No security roles need to be createdD . Data leakage and data separation across domainsView AnswerAnswer: D

A QRadar deployment professional wants to integrate a dynamic data set like asset information so that QRadar can use the latest information in the new data set to correlate the rules and alerts. How can the deployment professional achieve this?A . Use the UCM app.B . Import the dynamic data...

Which two (2) file formats are available for exporting offenses?A . XMLB . CSVC . PDFD . TXTE . XLSXView AnswerAnswer: AB